BeyondTrust Remote Support appliances now have a publicly disclosed file‑upload vulnerability (CVE-2026-102764) that was actively exploited by the ARMORY CASTLE actor in August 2026. The flaw permits arbitrary file placement, which the attacker leveraged to install a custom PHP webshell and maintain persistent access.
What Changed
BeyondTrust released security advisories and patches addressing the arbitrary upload issue. The vulnerability was observed in the appliance’s web interface, where POST requests to /app_84304470%2Ephp resulted in file creation under the web root. ARMORY CASTLE used the uploaded file to drop the SAWFLY webshell at /%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/. The webshell, identified as mangoapi.php, communicates via an obfuscated Base32 transport and a 256‑bit RC4 cipher, listening for the parameter _c94mfe.
Why It Matters to Engineers
Remote support appliances sit at the boundary of internal networks and external clients. An arbitrary upload that leads to a webshell gives an attacker direct code execution on the appliance, enabling privilege escalation, log tampering, and lateral movement. The incident shows that threat actors can quickly weaponize newly disclosed flaws, making timely patching critical for AI, cloud, DevOps, and security teams that rely on these devices for troubleshooting and remote management.
Operational and Security Implications
- Patch urgency: Apply the patches referenced in BeyondTrust’s security advisory immediately to close the upload vector.
- Log visibility: Evidence of exploitation appears in encrypted partitions (LUKS) containing
/home. Ensure you have a process to decrypt and review access, syslog, messages, thin‑scc, brain, and SSL logs for anomalous POST entries. - Webshell detection: Monitor the appliance file system for creation of files matching the SAWFLY pattern (
mangoapi.php) or unexpected files under the/%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/path. - Artifact removal: The actor routinely deletes logs and other artifacts. Implement immutable logging or forward logs to an external, tamper‑resistant store to retain evidence.
- Privilege escalation pathways: The use of proprietary CLI utilities and startup configuration templates suggests that compromised appliances can be leveraged to affect broader infrastructure. Review and restrict access to these utilities.
Related CloudNinjas coverage: Google Cloud.
What This Means For Practitioners
BeyondTrust Remote Support customers should verify that the latest patches are installed across all appliances and confirm that the patch level matches the vendor advisory. Augment existing monitoring with file‑integrity checks for the web root and alert on POST requests to unusual endpoints. Export and retain logs outside the appliance to guard against post‑compromise log wiping. Finally, incorporate the observed webshell signature (_c94mfe parameter) into IDS/IPS rules to catch future attempts.